Changeset 988 for vendor/current/source4/smb_server

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source4/smb_server

Files:

• blob.c (modified) (3 diffs)
• service_smb.c (modified) (3 diffs)
• session.c (modified) (2 diffs)
• smb/negprot.c (modified) (20 diffs)
• smb/receive.c (modified) (6 diffs)
• smb/reply.c (modified) (6 diffs)
• smb/request.c (modified) (5 diffs)
• smb/service.c (modified) (4 diffs)
• smb/sesssetup.c (modified) (10 diffs)
• smb/signing.c (modified) (1 diff)
• smb/trans2.c (modified) (7 diffs)
• smb/wscript_build (modified) (1 diff)
• smb2/fileinfo.c (modified) (1 diff)
• smb2/keepalive.c (modified) (2 diffs)
• smb2/negprot.c (modified) (5 diffs)
• smb2/receive.c (modified) (19 diffs)
• smb2/sesssetup.c (modified) (8 diffs)
• smb2/smb2_server.h (modified) (1 diff)
• smb2/tcon.c (modified) (5 diffs)
• smb2/wscript_build (modified) (1 diff)
• smb_samba3.c (deleted)
• smb_server.c (modified) (2 diffs)
• smb_server.h (modified) (5 diffs)
• wscript_build (modified) (1 diff)

vendor/current/source4/smb_server/blob.c

@@ -181 +181 @@
                                    int flags)
 {
-        size_t ret;
+        ssize_t ret;
         uint32_t offset;
         const int max_bytes_per_char = 3;
@@ -293 +293 @@
                 return NT_STATUS_OK;
         }
+
+        case RAW_QFS_SECTOR_SIZE_INFORMATION:
+                BLOB_CHECK(smbsrv_blob_grow_data(mem_ctx, blob, 28));
+                SIVAL(blob->data,  0,
+                      fsinfo->sector_size_info.out.logical_bytes_per_sector);
+                SIVAL(blob->data,  4,
+                     fsinfo->sector_size_info.out.phys_bytes_per_sector_atomic);
+                SIVAL(blob->data,  8,
+                      fsinfo->sector_size_info.out.phys_bytes_per_sector_perf);
+                SIVAL(blob->data, 12,
+                      fsinfo->sector_size_info.out.fs_effective_phys_bytes_per_sector_atomic);
+                SIVAL(blob->data, 16,
+                      fsinfo->sector_size_info.out.flags);
+                SIVAL(blob->data, 20,
+                      fsinfo->sector_size_info.out.byte_off_sector_align);
+                SIVAL(blob->data, 24,
+                      fsinfo->sector_size_info.out.byte_off_partition_align);
+
+                return NT_STATUS_OK;
+
         default:
                 return NT_STATUS_INVALID_LEVEL;
@@ -626 +646 @@
                 return NT_STATUS_OK;
 
+        case RAW_SFILEINFO_FULL_EA_INFORMATION:
+                return ea_pull_list_chained(blob,
+                                            mem_ctx,
+                                        &st->full_ea_information.in.eas.num_eas,
+                                        &st->full_ea_information.in.eas.eas);
+
         case RAW_SFILEINFO_MODE_INFORMATION:
                 BLOB_CHECK_MIN_SIZE(blob, 4);

vendor/current/source4/smb_server/service_smb.c

@@ -34 +34 @@
 #include "dsdb/samdb/samdb.h"
 #include "param/param.h"
+#include "file_server/file_server.h"
 
 /*
@@ -49 +50 @@
                 struct interface *ifaces;
 
-                load_interfaces(task, lpcfg_interfaces(task->lp_ctx), &ifaces);
+                load_interface_list(task, task->lp_ctx, &ifaces);
 
-                num_interfaces = iface_count(ifaces);
+                num_interfaces = iface_list_count(ifaces);
 
                 /* We have been given an interfaces line, and been 
@@ -58 +59 @@
                 */
                 for(i = 0; i < num_interfaces; i++) {
-                        const char *address = iface_n_ip(ifaces, i);
+                        const char *address = iface_list_n_ip(ifaces, i);
                         status = smbsrv_add_socket(task, task->event_ctx, task->lp_ctx, task->model_ops, address);
                         if (!NT_STATUS_IS_OK(status)) goto failed;
                 }
         } else {
-                /* Just bind to lpcfg_socket_address() (usually 0.0.0.0) */
-                status = smbsrv_add_socket(task, task->event_ctx, task->lp_ctx, task->model_ops,
-                                           lpcfg_socket_address(task->lp_ctx));
-                if (!NT_STATUS_IS_OK(status)) goto failed;
+                char **wcard;
+                int i;
+                wcard = iface_list_wildcard(task);
+                if (wcard == NULL) {
+                        DEBUG(0,("No wildcard addresses available\n"));
+                        goto failed;
+                }
+                for (i=0; wcard[i]; i++) {
+                        status = smbsrv_add_socket(task, task->event_ctx, task->lp_ctx, task->model_ops, wcard[i]);
+                        if (!NT_STATUS_IS_OK(status)) goto failed;
+                }
+                talloc_free(wcard);
         }
 
+        irpc_add_name(task->msg_ctx, "smb_server");
         return;
 failed:

vendor/current/source4/smb_server/session.c

@@ -86 +86 @@
         if (!p) return NULL;
 
-        /* only return an unfinished session */
-        sess = talloc_get_type(p, struct smbsrv_session);
-        if (sess && !sess->session_info) {
-                return sess;
-        }
-        return NULL;
+        sess = talloc_get_type_abort(p, struct smbsrv_session);
+
+        return sess;
 }
 
@@ -141 +138 @@
         int i;
 
-        /* Ensure no vuid gets registered in share level security. */
-        if (smb_conn->config.security == SEC_SHARE) return NULL;
-
         sess = talloc_zero(mem_ctx, struct smbsrv_session);
         if (!sess) return NULL;

vendor/current/source4/smb_server/smb/negprot.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "system/filesys.h"
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
@@ -89 +90 @@
 static void reply_coreplus(struct smbsrv_request *req, uint16_t choice)
 {
-        uint16_t raw = (lpcfg_readraw(req->smb_conn->lp_ctx)?1:0) | (lpcfg_writeraw(req->smb_conn->lp_ctx)?2:0);
+        uint16_t raw;
+        if (lpcfg_async_smb_echo_handler(req->smb_conn->lp_ctx)) {
+                raw = 0;
+        } else {
+                raw = (lpcfg_read_raw(req->smb_conn->lp_ctx)?1:0) |
+                      (lpcfg_write_raw(req->smb_conn->lp_ctx)?2:0);
+        }
 
         smbsrv_setup_reply(req, 13, 0);
@@ -120 +127 @@
 static void reply_lanman1(struct smbsrv_request *req, uint16_t choice)
 {
-        int raw = (lpcfg_readraw(req->smb_conn->lp_ctx)?1:0) | (lpcfg_writeraw(req->smb_conn->lp_ctx)?2:0);
         int secword=0;
         time_t t = req->request_time.tv_sec;
-
-        req->smb_conn->negotiate.encrypted_passwords = lpcfg_encrypted_passwords(req->smb_conn->lp_ctx);
-
-        if (lpcfg_security(req->smb_conn->lp_ctx) != SEC_SHARE)
-                secword |= NEGOTIATE_SECURITY_USER_LEVEL;
+        uint16_t raw;
+
+        if (lpcfg_async_smb_echo_handler(req->smb_conn->lp_ctx)) {
+                raw = 0;
+        } else {
+                raw = (lpcfg_read_raw(req->smb_conn->lp_ctx)?1:0) |
+                      (lpcfg_write_raw(req->smb_conn->lp_ctx)?2:0);
+        }
+
+        req->smb_conn->negotiate.encrypted_passwords = lpcfg_encrypt_passwords(req->smb_conn->lp_ctx);
 
         if (req->smb_conn->negotiate.encrypted_passwords)
@@ -143 +154 @@
         SSVAL(req->out.vwv, VWV(1), secword); 
         SSVAL(req->out.vwv, VWV(2), req->smb_conn->negotiate.max_recv);
-        SSVAL(req->out.vwv, VWV(3), lpcfg_maxmux(req->smb_conn->lp_ctx));
+        SSVAL(req->out.vwv, VWV(3), lpcfg_max_mux(req->smb_conn->lp_ctx));
         SSVAL(req->out.vwv, VWV(4), 1);
         SSVAL(req->out.vwv, VWV(5), raw); 
-        SIVAL(req->out.vwv, VWV(6), req->smb_conn->connection->server_id.id);
+        SIVAL(req->out.vwv, VWV(6), req->smb_conn->connection->server_id.pid);
         srv_push_dos_date(req->smb_conn, req->out.vwv, VWV(8), t);
         SSVAL(req->out.vwv, VWV(10), req->smb_conn->negotiate.zone_offset/60);
@@ -178 +189 @@
 static void reply_lanman2(struct smbsrv_request *req, uint16_t choice)
 {
-        int raw = (lpcfg_readraw(req->smb_conn->lp_ctx)?1:0) | (lpcfg_writeraw(req->smb_conn->lp_ctx)?2:0);
         int secword=0;
         time_t t = req->request_time.tv_sec;
-
-        req->smb_conn->negotiate.encrypted_passwords = lpcfg_encrypted_passwords(req->smb_conn->lp_ctx);
+        uint16_t raw;
+        if (lpcfg_async_smb_echo_handler(req->smb_conn->lp_ctx)) {
+                raw = 0;
+        } else {
+                raw = (lpcfg_read_raw(req->smb_conn->lp_ctx)?1:0) |
+                      (lpcfg_write_raw(req->smb_conn->lp_ctx)?2:0);
+        }
+
+        req->smb_conn->negotiate.encrypted_passwords = lpcfg_encrypt_passwords(req->smb_conn->lp_ctx);
   
-        if (lpcfg_security(req->smb_conn->lp_ctx) != SEC_SHARE)
-                secword |= NEGOTIATE_SECURITY_USER_LEVEL;
-
         if (req->smb_conn->negotiate.encrypted_passwords)
                 secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
@@ -197 +211 @@
         SSVAL(req->out.vwv, VWV(1), secword); 
         SSVAL(req->out.vwv, VWV(2), req->smb_conn->negotiate.max_recv);
-        SSVAL(req->out.vwv, VWV(3), lpcfg_maxmux(req->smb_conn->lp_ctx));
+        SSVAL(req->out.vwv, VWV(3), lpcfg_max_mux(req->smb_conn->lp_ctx));
         SSVAL(req->out.vwv, VWV(4), 1);
         SSVAL(req->out.vwv, VWV(5), raw); 
-        SIVAL(req->out.vwv, VWV(6), req->smb_conn->connection->server_id.id);
+        SIVAL(req->out.vwv, VWV(6), req->smb_conn->connection->server_id.pid);
         srv_push_dos_date(req->smb_conn, req->out.vwv, VWV(8), t);
         SSVAL(req->out.vwv, VWV(10), req->smb_conn->negotiate.zone_offset/60);
@@ -239 +253 @@
 }
 
+/*
+  try to determine if the filesystem supports large files
+*/
+static bool large_file_support(const char *path)
+{
+        int fd;
+        ssize_t ret;
+        char c;
+
+        fd = open(path, O_RDWR|O_CREAT, 0600);
+        unlink(path);
+        if (fd == -1) {
+                /* have to assume large files are OK */
+                return true;
+        }
+        ret = pread(fd, &c, 1, ((uint64_t)1)<<32);
+        close(fd);
+        return ret == 0;
+}
+
 /****************************************************************************
  Reply for the nt protocol.
@@ -258 +292 @@
                 CAP_LEVEL_II_OPLOCKS | CAP_NT_SMBS | CAP_RPC_REMOTE_APIS;
 
-        req->smb_conn->negotiate.encrypted_passwords = lpcfg_encrypted_passwords(req->smb_conn->lp_ctx);
+        req->smb_conn->negotiate.encrypted_passwords = lpcfg_encrypt_passwords(req->smb_conn->lp_ctx);
 
         /* do spnego in user level security if the client
@@ -264 +298 @@
         
         if (req->smb_conn->negotiate.encrypted_passwords && 
-            (lpcfg_security(req->smb_conn->lp_ctx) != SEC_SHARE) &&
             lpcfg_use_spnego(req->smb_conn->lp_ctx) &&
             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
@@ -271 +304 @@
         }
         
-        if (lpcfg_unix_extensions(req->smb_conn->lp_ctx)) {
-                capabilities |= CAP_UNIX;
-        }
-        
         if (lpcfg_large_readwrite(req->smb_conn->lp_ctx)) {
                 capabilities |= CAP_LARGE_READX | CAP_LARGE_WRITEX | CAP_W2K_SMBS;
         }
 
-        large_test_path = lock_path(req, req->smb_conn->lp_ctx, "large_test.dat");
+        large_test_path = lpcfg_lock_path(req, req->smb_conn->lp_ctx, "large_test.dat");
         if (large_file_support(large_test_path)) {
                 capabilities |= CAP_LARGE_FILES;
         }
 
-        if (lpcfg_readraw(req->smb_conn->lp_ctx) &&
-            lpcfg_writeraw(req->smb_conn->lp_ctx)) {
+        if (!lpcfg_async_smb_echo_handler(req->smb_conn->lp_ctx) &&
+            lpcfg_read_raw(req->smb_conn->lp_ctx) &&
+            lpcfg_write_raw(req->smb_conn->lp_ctx)) {
                 capabilities |= CAP_RAW_MODE;
         }
@@ -302 +332 @@
         }
         
-        if (lpcfg_security(req->smb_conn->lp_ctx) != SEC_SHARE) {
-                secword |= NEGOTIATE_SECURITY_USER_LEVEL;
-        }
+        secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 
         if (req->smb_conn->negotiate.encrypted_passwords) {
@@ -329 +357 @@
            the specification - all the command words after the secword
            are offset by 1 byte */
-        SSVAL(req->out.vwv+1, VWV(1), lpcfg_maxmux(req->smb_conn->lp_ctx));
+        SSVAL(req->out.vwv+1, VWV(1), lpcfg_max_mux(req->smb_conn->lp_ctx));
         SSVAL(req->out.vwv+1, VWV(2), 1); /* num vcs */
         SIVAL(req->out.vwv+1, VWV(3), req->smb_conn->negotiate.max_recv);
         SIVAL(req->out.vwv+1, VWV(5), 0x10000); /* raw size. full 64k */
-        SIVAL(req->out.vwv+1, VWV(7), req->smb_conn->connection->server_id.id); /* session key */
+        SIVAL(req->out.vwv+1, VWV(7), req->smb_conn->connection->server_id.pid); /* session key */
+
         SIVAL(req->out.vwv+1, VWV(9), capabilities);
         push_nttime(req->out.vwv+1, VWV(11), nttime);
@@ -359 +388 @@
                 if (!NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status)));
-                        talloc_free(server_credentials);
-                        server_credentials = NULL;
+                        /*
+                         * We keep the server_credentials as anonymous
+                         * this is required for the spoolss.notify test
+                         */
                 }
 
@@ -383 +414 @@
                 req->smb_conn->negotiate.server_credentials = talloc_reparent(req, req->smb_conn, server_credentials);
 
-                gensec_set_target_service(gensec_security, "cifs");
-
-                gensec_set_credentials(gensec_security, server_credentials);
-
                 oid = GENSEC_OID_SPNEGO;
                 nt_status = gensec_start_mech_by_oid(gensec_security, oid);
@@ -392 +419 @@
                 if (NT_STATUS_IS_OK(nt_status)) {
                         /* Get and push the proposed OID list into the packets */
-                        nt_status = gensec_update(gensec_security, req, null_data_blob, &blob);
+                        nt_status = gensec_update_ev(gensec_security, req, req->smb_conn->connection->event.ctx, null_data_blob, &blob);
 
                         if (!NT_STATUS_IS_OK(nt_status) && !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
@@ -465 +492 @@
         int protocol_level;
 } supported_protocols[] = {
-        {"SMB 2.002",                   "SMB2",         reply_smb2,     PROTOCOL_SMB2},
+        {"SMB 2.002",                   "SMB2",         reply_smb2,     PROTOCOL_SMB2_02},
         {"NT LANMAN 1.0",               "NT1",          reply_nt1,      PROTOCOL_NT1},
         {"NT LM 0.12",                  "NT1",          reply_nt1,      PROTOCOL_NT1},
@@ -489 +516 @@
         uint8_t *p;
         uint32_t protos_count = 0;
-        char **protos = NULL;
+        const char **protos = NULL;
 
         if (req->smb_conn->negotiate.done_negprot) {
@@ -501 +528 @@
                 size_t len;
 
-                protos = talloc_realloc(req, protos, char *, protos_count + 1);
+                protos = talloc_realloc(req, protos, const char *, protos_count + 1);
                 if (!protos) {
                         smbsrv_terminate_connection(req->smb_conn, nt_errstr(NT_STATUS_NO_MEMORY));
@@ -507 +534 @@
                 }
                 protos[protos_count] = NULL;
-                len = req_pull_ascii4(&req->in.bufinfo, (const char **)&protos[protos_count], p, STR_ASCII|STR_TERMINATE);
+                len = req_pull_ascii4(&req->in.bufinfo, &protos[protos_count], p, STR_ASCII|STR_TERMINATE);
                 p += len;
                 if (len == 0 || !protos[protos_count]) break;
@@ -519 +546 @@
                 int i;
 
-                if (supported_protocols[protocol].protocol_level > lpcfg_srv_maxprotocol(req->smb_conn->lp_ctx))
+                if (supported_protocols[protocol].protocol_level > lpcfg_server_max_protocol(req->smb_conn->lp_ctx))
                         continue;
-                if (supported_protocols[protocol].protocol_level < lpcfg_srv_minprotocol(req->smb_conn->lp_ctx))
+                if (supported_protocols[protocol].protocol_level < lpcfg_server_min_protocol(req->smb_conn->lp_ctx))
                         continue;
 

vendor/current/source4/smb_server/smb/receive.c

@@ -26 +26 @@
 #include "system/filesys.h"
 #include "param/param.h"
-
+#include "cluster/cluster.h"
 
 /*
@@ -104 +104 @@
 /* 0x0e */ { "SMBctemp",        smbsrv_reply_ctemp,             NEED_SESS|NEED_TCON },
 /* 0x0f */ { "SMBmknew",        smbsrv_reply_mknew,             NEED_SESS|NEED_TCON }, 
-/* 0x10 */ { "SMBchkpth",       smbsrv_reply_chkpth,            NEED_SESS|NEED_TCON },
+/* 0x10 */ { "SMBcheckpath",    smbsrv_reply_chkpth,            NEED_SESS|NEED_TCON },
 /* 0x11 */ { "SMBexit",         smbsrv_reply_exit,              NEED_SESS },
 /* 0x12 */ { "SMBlseek",        smbsrv_reply_lseek,             NEED_SESS|NEED_TCON },
@@ -472 +472 @@
         struct smbsrv_connection *smb_conn = req->smb_conn;
         NTSTATUS status;
+        struct server_id_buf idbuf;
 
         type &= 0xff;
@@ -492 +493 @@
                    chaining) */
 
-                /* In share mode security we must ignore the vuid. */
-                if (smb_conn->config.security == SEC_SHARE) {
-                        if (req->tcon) {
-                                req->session = req->tcon->sec_share.session;
-                        }
-                } else {
-                        req->session = smbsrv_session_find(req->smb_conn, SVAL(req->in.hdr,HDR_UID), req->request_time);
-                }
-        }
-
-        DEBUG(5,("switch message %s (task_id %u)\n",
-                 smb_fn_name(type), (unsigned)req->smb_conn->connection->server_id.id));
+                req->session = smbsrv_session_find(req->smb_conn, SVAL(req->in.hdr,HDR_UID), req->request_time);
+        }
+
+        DEBUG(5, ("switch message %s (task_id %s)\n",
+                  smb_fn_name(type),
+                  server_id_str_buf(req->smb_conn->connection->server_id,
+                                    &idbuf)));
 
         /* this must be called before we do any reply */
@@ -638 +634 @@
 
         /* cleanup somestuff for the next request */
-        talloc_free(req->ntvfs);
+        DLIST_REMOVE(req->smb_conn->requests, req);
+        talloc_unlink(req, req->ntvfs);
         req->ntvfs = NULL;
         talloc_free(req->io_ptr);
@@ -668 +665 @@
         smb_conn->negotiate.zone_offset = get_time_zone(time(NULL));
 
-        smb_conn->config.security = lpcfg_security(lp_ctx);
         smb_conn->config.nt_status_support = lpcfg_nt_status_support(lp_ctx);
 

vendor/current/source4/smb_server/smb/reply.c

@@ -28 +28 @@
 #include "ntvfs/ntvfs.h"
 #include "librpc/gen_ndr/ndr_nbt.h"
+#include "libcli/nbt/libnbt.h"
 
 
@@ -848 +849 @@
 {
         union smb_read *io;
+        uint16_t high_part = 0;
 
         /* parse request */
@@ -869 +871 @@
         }
 
-        if (req->smb_conn->negotiate.client_caps & CAP_LARGE_READX) {
-                uint32_t high_part = IVAL(req->in.vwv, VWV(7));
-                if (high_part == 1) {
-                        io->readx.in.maxcnt |= high_part << 16;
-                }
-        }
-        
+        if (req->smb_conn->negotiate.protocol == PROTOCOL_NT1) {
+                high_part = SVAL(req->in.vwv, VWV(7));
+        }
+        if (high_part != UINT16_MAX) {
+                io->readx.in.maxcnt |= high_part << 16;
+        }
+
+        /*
+         * Windows truncates the length to 0x10000
+         */
+        io->readx.in.maxcnt = MIN(io->readx.in.maxcnt, 0x10000);
+
         /* the 64 bit variant */
         if (req->in.wct == 12) {
@@ -2334 +2341 @@
         
         switch (msg_type) {
-        case 0x81: /* session request */
+        case NBSSrequest: /* session request */
                 if (req->smb_conn->negotiate.done_nbt_session) {
                         DEBUG(0,("Warning: ignoring secondary session request\n"));
@@ -2354 +2361 @@
         case 0x89: /* session keepalive request 
                       (some old clients produce this?) */
-                SCVAL(buf, 0, SMBkeepalive);
+                SCVAL(buf, 0, NBSSkeepalive);
                 SCVAL(buf, 3, 0);
                 req->out.buffer = buf;
@@ -2361 +2368 @@
                 return;
                 
-        case SMBkeepalive: 
+        case NBSSkeepalive:
                 /* session keepalive - swallow it */
                 talloc_free(req);

vendor/current/source4/smb_server/smb/request.c

@@ -312 +312 @@
 
         if (req->out.size > NBT_HDR_SIZE) {
-                _smb_setlen(req->out.buffer, req->out.size - NBT_HDR_SIZE);
+                _smb_setlen_nbt(req->out.buffer, req->out.size - NBT_HDR_SIZE);
         }
 
@@ -484 +484 @@
         bool ret;
         char *dest2;
+        size_t converted_size = 0;
 
         if (!(flags & STR_NOALIGN) && ucs2_align(bufinfo->align_base, src, flags)) {
@@ -513 +514 @@
         }
 
-        ret = convert_string_talloc(bufinfo->mem_ctx, CH_UTF16, CH_UNIX, src, src_len2, (void **)&dest2, NULL, false);
+        ret = convert_string_talloc(bufinfo->mem_ctx, CH_UTF16, CH_UNIX, src, src_len2, (void **)&dest2, &converted_size);
 
         if (!ret) {
@@ -542 +543 @@
         bool ret;
         char *dest2;
+        size_t converted_size = 0;
 
         if (flags & STR_NO_RANGE_CHECK) {
@@ -562 +564 @@
         }
 
-        ret = convert_string_talloc(bufinfo->mem_ctx, CH_DOS, CH_UNIX, src, src_len2, (void **)&dest2, NULL, false);
+        ret = convert_string_talloc(bufinfo->mem_ctx, CH_DOS, CH_UNIX, src, src_len2, (void **)&dest2, &converted_size);
 
         if (!ret) {

vendor/current/source4/smb_server/smb/service.c

@@ -112 +112 @@
         const char *type_str;
         struct share_config *scfg;
-        const char *sharetype;
+        char *sharetype;
 
         /* the service might be of the form \\SERVER\SHARE. Should we put
@@ -125 +125 @@
         status = share_get_config(req, req->smb_conn->share_context, service, &scfg);
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("make_connection: couldn't find service %s\n", service));
+                DEBUG(0,("make_connection: couldn't find service %s: %s\n", service, nt_errstr(status)));
                 return NT_STATUS_BAD_NETWORK_NAME;
         }
@@ -139 +139 @@
 
         /* work out what sort of connection this is */
-        sharetype = share_string_option(scfg, "type", "DISK");
+        sharetype = share_string_option(req, scfg, "type", "DISK");
         if (sharetype && strcmp(sharetype, "IPC") == 0) {
                 type = NTVFS_IPC;
@@ -150 +150 @@
                 type_str = "A:";
         }
+        TALLOC_FREE(sharetype);
 
         if (strcmp(dev, "?????") != 0 && strcasecmp(type_str, dev) != 0) {

vendor/current/source4/smb_server/smb/sesssetup.c

@@ -35 +35 @@
 
 struct sesssetup_context {
-        struct auth_context *auth_context;
+        struct auth4_context *auth_context;
         struct smbsrv_request *req;
 };
@@ -84 +84 @@
         }
         /* This references user_info_dc into session_info */
-        status = req->smb_conn->negotiate.auth_context->generate_session_info(req,
-                                                                              req->smb_conn->negotiate.auth_context,
-                                                                              user_info_dc, flags, &session_info);
+        status = req->smb_conn->negotiate.auth_context->generate_session_info(req->smb_conn->negotiate.auth_context,
+                                                                              req,
+                                                                              user_info_dc, sess->old.in.user, 
+                                                                              flags, &session_info);
         if (!NT_STATUS_IS_OK(status)) goto failed;
 
@@ -215 +216 @@
         }
         /* This references user_info_dc into session_info */
-        status = state->auth_context->generate_session_info(req,
-                                                            state->auth_context,
+        status = state->auth_context->generate_session_info(state->auth_context,
+                                                            req,
                                                             user_info_dc,
+                                                            sess->nt1.in.user,
                                                             flags,
                                                             &session_info);
@@ -262 +264 @@
         struct tevent_req *subreq;
         struct sesssetup_context *state;
+        bool allow_raw = lpcfg_raw_ntlmv2_auth(req->smb_conn->lp_ctx);
 
         sess->nt1.out.vuid = 0;
@@ -337 +340 @@
         user_info->password.response.nt.data = talloc_steal(user_info, sess->nt1.in.password2.data);
 
+        if (!allow_raw && user_info->password.response.nt.length >= 48) {
+                /*
+                 * NTLMv2_RESPONSE has at least 48 bytes
+                 * and should only be supported via NTLMSSP.
+                 */
+                status = NT_STATUS_INVALID_PARAMETER;
+                goto failed;
+        }
+
         subreq = auth_check_password_send(state,
                                           req->smb_conn->connection->event.ctx,
@@ -380 +392 @@
         }
 
-        status = gensec_session_info(smb_sess->gensec_ctx, &session_info);
-        if (!NT_STATUS_IS_OK(status)) goto failed;
-
-        skey_status = gensec_session_key(smb_sess->gensec_ctx, &session_key);
+        status = gensec_session_info(smb_sess->gensec_ctx, smb_sess, &session_info);
+        if (!NT_STATUS_IS_OK(status)) goto failed;
+
+        /* The session_key is only needed until the end of the smbsrv_setup_signing() call */
+        skey_status = gensec_session_key(smb_sess->gensec_ctx, req, &session_key);
         if (NT_STATUS_IS_OK(skey_status)) {
                 smbsrv_setup_signing(req->smb_conn, &session_key, NULL);
@@ -413 +426 @@
         NTSTATUS status;
         struct smbsrv_session *smb_sess = NULL;
+        bool is_smb_sess_new = false;
         struct sesssetup_spnego_state *s = NULL;
         uint16_t vuid;
@@ -433 +447 @@
 
         /* lookup an existing session */
-        smb_sess = smbsrv_session_find_sesssetup(req->smb_conn, vuid);
-        if (!smb_sess) {
+        if (vuid == 0) {
                 struct gensec_security *gensec_ctx;
 
@@ -464 +477 @@
                         goto failed;
                 }
+                is_smb_sess_new = true;
+        } else {
+                smb_sess = smbsrv_session_find_sesssetup(req->smb_conn, vuid);
         }
 
         if (!smb_sess) {
-                status = NT_STATUS_ACCESS_DENIED;
+                status = NT_STATUS_DOS(ERRSRV, ERRbaduid);
+                goto failed;
+        }
+
+        if (smb_sess->session_info) {
+                status = NT_STATUS_INVALID_PARAMETER;
                 goto failed;
         }
@@ -502 +523 @@
         status = NT_STATUS_NO_MEMORY;
 failed:
-        talloc_free(smb_sess);
+        if (is_smb_sess_new) {
+                talloc_free(smb_sess);
+        }
         status = nt_status_squash(status);
         smbsrv_sesssetup_backend_send(req, sess, status);

vendor/current/source4/smb_server/smb/signing.c

@@ -82 +82 @@
                 return false;
         }
-        
-        switch (lpcfg_server_signing(smb_conn->lp_ctx)) {
-        case SMB_SIGNING_OFF:
-                smb_conn->signing.allow_smb_signing = false;
-                break;
-        case SMB_SIGNING_SUPPORTED:
-                smb_conn->signing.allow_smb_signing = true;
-                break;
-        case SMB_SIGNING_REQUIRED:
-                smb_conn->signing.allow_smb_signing = true;
-                smb_conn->signing.mandatory_signing = true;
-                break;
-        case SMB_SIGNING_AUTO:
-                /* If we are a domain controller, SMB signing is
-                 * really important, as it can prevent a number of
-                 * attacks on communications between us and the
-                 * clients */
 
-                if (lpcfg_server_role(smb_conn->lp_ctx) == ROLE_DOMAIN_CONTROLLER) {
-                        smb_conn->signing.allow_smb_signing = true;
-                        smb_conn->signing.mandatory_signing = true;
-                } else {
-                        /* However, it really sucks (no sendfile, CPU
-                         * overhead) performance-wise when used on a
-                         * file server, so disable it by default (auto
-                         * is the default) on non-DCs */
-                        smb_conn->signing.allow_smb_signing = false;
-                }
-                break;
-        }
+        smb_conn->signing.allow_smb_signing
+                = lpcfg_server_signing_allowed(smb_conn->lp_ctx,
+                                               &smb_conn->signing.mandatory_signing);
         return true;
 }

vendor/current/source4/smb_server/smb/trans2.c

@@ -3 +3 @@
    transaction2 handling
    Copyright (C) Andrew Tridgell 2003
-   Copyright Matthieu Patou 2010 mat@matws.net
+   Copyright Matthieu Patou <mat@matws.net> 2010-2011
 
    This program is free software; you can redistribute it and/or modify
@@ -34 +34 @@
 #include "param/param.h"
 #include "lib/tsocket/tsocket.h"
+#include "dfs_server/dfs_server_ad.h"
 
 #define MAX_DFS_RESPONSE 56*1024 /* 56 Kb */
@@ -64 +65 @@
         void *op_info;
 };
-/* A DC set is a group of DC, they might have been grouped together
-   because they belong to the same site, or to site with same cost ...
-*/
-struct dc_set {
-        const char **names;
-        uint32_t count;
-};
+
 #define CHECK_MIN_BLOB_SIZE(blob, size) do { \
         if ((blob)->length < (size)) { \
@@ -859 +854 @@
 }
 
-
-/*
-  fill a referral type structure
- */
-static NTSTATUS fill_normal_dfs_referraltype(struct dfs_referral_type *ref,
-                                             uint16_t version,
-                                             const char *dfs_path,
-                                             const char *server_path, int isfirstoffset)
-{
-
-        switch (version) {
-        case 3:
-                ZERO_STRUCTP(ref);
-                ref->version = version;
-                ref->referral.v3.data.server_type = DFS_SERVER_NON_ROOT;
-                /* "normal" referral seems to always include the GUID */
-                ref->referral.v3.size = 34;
-
-                ref->referral.v3.data.entry_flags = 0;
-                ref->referral.v3.data.ttl = 600; /* As w2k3 */
-                ref->referral.v3.data.referrals.r1.DFS_path = dfs_path;
-                ref->referral.v3.data.referrals.r1.DFS_alt_path = dfs_path;
-                ref->referral.v3.data.referrals.r1.netw_address = server_path;
-                return NT_STATUS_OK;
-        case 4:
-                ZERO_STRUCTP(ref);
-                ref->version = version;
-                ref->referral.v4.server_type = DFS_SERVER_NON_ROOT;
-                /* "normal" referral seems to always include the GUID */
-                ref->referral.v4.size = 34;
-
-                if (isfirstoffset) {
-                        ref->referral.v4.entry_flags =  DFS_HEADER_FLAG_TARGET_BCK;
-                }
-                ref->referral.v4.ttl = 600; /* As w2k3 */
-                ref->referral.v4.r1.DFS_path = dfs_path;
-                ref->referral.v4.r1.DFS_alt_path = dfs_path;
-                ref->referral.v4.r1.netw_address = server_path;
-
-                return NT_STATUS_OK;
-        }
-        return NT_STATUS_INVALID_LEVEL;
-}
-
-/*
-  fill a domain refererral
- */
-static NTSTATUS fill_domain_dfs_referraltype(struct dfs_referral_type *ref,
-                                             uint16_t version,
-                                             const char *domain,
-                                             const char **names,
-                                             uint16_t numnames)
-{
-        switch (version) {
-        case 3:
-                ZERO_STRUCTP(ref);
-                ref->version = version;
-                ref->referral.v3.data.server_type = DFS_SERVER_NON_ROOT;
-                /* It's hard coded ... don't think it's a good way but the sizeof return not the
-                 * correct values
-                 *
-                 * We have 18 if the GUID is not included 34 otherwise
-                */
-                ref->referral.v3.size = 18;
-                ref->referral.v3.data.entry_flags = DFS_FLAG_REFERRAL_DOMAIN_RESP;
-                ref->referral.v3.data.ttl = 600; /* As w2k3 */
-                ref->referral.v3.data.referrals.r2.special_name = domain;
-                ref->referral.v3.data.referrals.r2.nb_expanded_names = numnames;
-                /* Put the final terminator */
-                if (names) {
-                        const char **names2 = talloc_array(ref, const char *, numnames+1);
-                        NT_STATUS_HAVE_NO_MEMORY(names2);
-                        int i;
-                        for (i = 0; i<numnames; i++) {
-                                names2[i] = talloc_asprintf(names2, "\\%s", names[i]);
-                                NT_STATUS_HAVE_NO_MEMORY(names2[i]);
-                        }
-                        names2[numnames] = 0;
-                        ref->referral.v3.data.referrals.r2.expanded_names = names2;
-                }
-                return NT_STATUS_OK;
-        }
-        return NT_STATUS_INVALID_LEVEL;
-}
-
-/*
-  get the DCs list within a site
- */
-static NTSTATUS get_dcs_insite(TALLOC_CTX *ctx, struct ldb_context *ldb,
-                               struct ldb_dn *sitedn, struct dc_set *list,
-                               bool dofqdn)
-{
-        static const char *attrs[] = { "serverReference", NULL };
-        static const char *attrs2[] = { "dNSHostName", "sAMAccountName", NULL };
-        struct ldb_result *r;
-        unsigned int i;
-        int ret;
-        const char **dc_list;
-
-        ret = ldb_search(ldb, ctx, &r, sitedn, LDB_SCOPE_SUBTREE, attrs,
-                         "(&(objectClass=server)(serverReference=*))");
-        if (ret != LDB_SUCCESS) {
-                DEBUG(2,(__location__ ": Failed to get list of servers - %s\n",
-                         ldb_errstring(ldb)));
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        if (r->count == 0) {
-                /* none in this site */
-                talloc_free(r);
-                return NT_STATUS_OK;
-        }
-
-        /*
-         * need to search for all server object to know the size of the array.
-         * Search all the object of class server in this site
-         */
-        dc_list = talloc_array(r, const char *, r->count);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(dc_list, r);
-
-        /* TODO put some random here in the order */
-        list->names = talloc_realloc(list, list->names, const char *, list->count + r->count);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(list->names, r);
-
-        for (i = 0; i<r->count; i++) {
-                struct ldb_dn  *dn;
-                struct ldb_result *r2;
-
-                dn = ldb_msg_find_attr_as_dn(ldb, ctx, r->msgs[i], "serverReference");
-                if (!dn) {
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-
-                ret = ldb_search(ldb, r, &r2, dn, LDB_SCOPE_BASE, attrs2, "(objectClass=computer)");
-                if (ret != LDB_SUCCESS) {
-                        DEBUG(2,(__location__ ": Search for computer on %s failed - %s\n",
-                                 ldb_dn_get_linearized(dn), ldb_errstring(ldb)));
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-
-                if (dofqdn) {
-                        const char *dns = ldb_msg_find_attr_as_string(r2->msgs[0], "dNSHostName", NULL);
-                        if (dns == NULL) {
-                                DEBUG(2,(__location__ ": dNSHostName missing on %s\n",
-                                         ldb_dn_get_linearized(dn)));
-                                talloc_free(r);
-                                return NT_STATUS_INTERNAL_ERROR;
-                        }
-
-                        list->names[list->count] = talloc_strdup(list->names, dns);
-                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(list->names[list->count], r);
-                } else {
-                        char *tmp;
-                        const char *acct = ldb_msg_find_attr_as_string(r2->msgs[0], "sAMAccountName", NULL);
-                        if (acct == NULL) {
-                                DEBUG(2,(__location__ ": sAMAccountName missing on %s\n",
-                                         ldb_dn_get_linearized(dn)));
-                                talloc_free(r);
-                                return NT_STATUS_INTERNAL_ERROR;
-                        }
-
-                        tmp = talloc_strdup(list->names, acct);
-                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(tmp, r);
-
-                        /* Netbios name is also the sAMAccountName for
-                           computer but without the final $ */
-                        tmp[strlen(tmp) - 1] = '\0';
-                        list->names[list->count] = tmp;
-                }
-                list->count++;
-                talloc_free(r2);
-        }
-
-        talloc_free(r);
-        return NT_STATUS_OK;
-}
-
-
-/*
-  get all DCs
- */
-static NTSTATUS get_dcs(TALLOC_CTX *ctx, struct ldb_context *ldb,
-                        const char *searched_site, bool need_fqdn,
-                        struct dc_set ***pset_list, uint32_t flags)
-{
-        /*
-         * Flags will be used later to indicate things like least-expensive
-         * or same-site options
-         */
-        const char *attrs_none[] = { NULL };
-        const char *attrs3[] = { "name", NULL };
-        struct ldb_dn *configdn, *sitedn, *dn, *sitescontainerdn;
-        struct ldb_result *r;
-        struct dc_set **set_list = NULL;
-        uint32_t i;
-        int ret;
-        uint32_t current_pos = 0;
-        NTSTATUS status;
-        TALLOC_CTX *subctx = talloc_new(ctx);
-
-        *pset_list = set_list = NULL;
-
-        subctx = talloc_new(ctx);
-        NT_STATUS_HAVE_NO_MEMORY(subctx);
-
-        configdn = ldb_get_config_basedn(ldb);
-
-        /* Let's search for the Site container */
-        ret = ldb_search(ldb, subctx, &r, configdn, LDB_SCOPE_SUBTREE, attrs_none,
-                         "(objectClass=sitesContainer)");
-        if (ret != LDB_SUCCESS) {
-                DEBUG(2,(__location__ ": Failed to find sitesContainer within %s - %s\n",
-                         ldb_dn_get_linearized(configdn), ldb_errstring(ldb)));
-                talloc_free(subctx);
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-        if (r->count > 1) {
-                DEBUG(2,(__location__ ": Expected 1 sitesContainer - found %u within %s\n",
-                         r->count, ldb_dn_get_linearized(configdn)));
-                talloc_free(subctx);
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        sitescontainerdn = talloc_steal(subctx, r->msgs[0]->dn);
-        talloc_free(r);
-
-        /*
-         * TODO: Here we should have a more subtle handling
-         * for the case "same-site"
-         */
-        ret = ldb_search(ldb, subctx, &r, sitescontainerdn, LDB_SCOPE_SUBTREE,
-                         attrs_none, "(objectClass=server)");
-        if (ret != LDB_SUCCESS) {
-                DEBUG(2,(__location__ ": Failed to find servers within %s - %s\n",
-                         ldb_dn_get_linearized(sitescontainerdn), ldb_errstring(ldb)));
-                talloc_free(subctx);
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-        talloc_free(r);
-
-        if (searched_site != NULL) {
-                ret = ldb_search(ldb, subctx, &r, configdn, LDB_SCOPE_SUBTREE,
-                                 attrs_none, "(&(name=%s)(objectClass=site))", searched_site);
-                if (ret != LDB_SUCCESS) {
-                        talloc_free(subctx);
-                        return NT_STATUS_FOOBAR;
-                } else if (r->count != 1) {
-                        talloc_free(subctx);
-                        return NT_STATUS_FOOBAR;
-                }
-
-                /* All of this was to get the DN of the searched_site */
-                sitedn = r->msgs[0]->dn;
-
-                set_list = talloc_realloc(subctx, set_list, struct dc_set *, current_pos+1);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(set_list, subctx);
-
-                set_list[current_pos] = talloc(set_list, struct dc_set);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(set_list[current_pos], subctx);
-
-                set_list[current_pos]->names = NULL;
-                set_list[current_pos]->count = 0;
-                status = get_dcs_insite(subctx, ldb, sitedn,
-                                        set_list[current_pos], need_fqdn);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(2,(__location__ ": Failed to get DC from site %s - %s\n",
-                                 ldb_dn_get_linearized(sitedn), nt_errstr(status)));
-                        talloc_free(subctx);
-                        return status;
-                }
-                talloc_free(r);
-                current_pos++;
-        }
-
-        /* Let's find all the sites */
-        ret = ldb_search(ldb, subctx, &r, configdn, LDB_SCOPE_SUBTREE, attrs3, "(objectClass=site)");
-        if (ret != LDB_SUCCESS) {
-                DEBUG(2,(__location__ ": Failed to find any site containers in %s\n",
-                         ldb_dn_get_linearized(configdn)));
-                talloc_free(subctx);
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
-        /*
-         * TODO:
-         * We should randomize the order in the main site,
-         * it's mostly needed for sysvol/netlogon referral.
-         * Depending of flag we either randomize order of the
-         * not "in the same site DCs"
-         * or we randomize by group of site that have the same cost
-         * In the long run we want to manipulate an array of site_set
-         * All the site in one set have the same cost (if least-expansive options is selected)
-         * and we will put all the dc related to 1 site set into 1 DCs set.
-         * Within a site set, site order has to be randomized
-         *
-         * But for the moment we just return the list of sites
-         */
-        if (r->count) {
-                /*
-                 * We will realloc + 2 because we will need one additional place
-                 * for element at current_pos + 1 for the NULL element
-                 */
-                set_list = talloc_realloc(subctx, set_list, struct dc_set *,
-                                          current_pos+2);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(set_list, subctx);
-
-                set_list[current_pos] = talloc(ctx, struct dc_set);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(set_list[current_pos], subctx);
-
-                set_list[current_pos]->names = NULL;
-                set_list[current_pos]->count = 0;
-
-                set_list[current_pos+1] = NULL;
-        }
-
-        for (i=0; i<r->count; i++) {
-                const char *site_name = ldb_msg_find_attr_as_string(r->msgs[i], "name", NULL);
-                if (site_name == NULL) {
-                        DEBUG(2,(__location__ ": Failed to find name attribute in %s\n",
-                                 ldb_dn_get_linearized(r->msgs[i]->dn)));
-                        talloc_free(subctx);
-                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
-                }
-
-                if (searched_site == NULL ||
-                    strcmp(searched_site, site_name) != 0) {
-                        DEBUG(2,(__location__ ": Site: %s %s\n",
-                                searched_site, site_name));
-
-                        /*
-                         * Do all the site but the one of the client
-                         * (because it has already been done ...)
-                         */
-                        dn = r->msgs[i]->dn;
-
-                        status = get_dcs_insite(subctx, ldb, dn,
-                                                set_list[current_pos],
-                                                need_fqdn);
-                        if (!NT_STATUS_IS_OK(status)) {
-                                talloc_free(subctx);
-                                return status;
-                        }
-                }
-        }
-        current_pos++;
-        set_list[current_pos] = NULL;
-
-        *pset_list = talloc_move(ctx, &set_list);
-        talloc_free(subctx);
-        return NT_STATUS_OK;
-}
-
-static NTSTATUS dodomain_referral(TALLOC_CTX *ctx,
-                                  const struct dfs_GetDFSReferral_in *dfsreq,
-                                  struct ldb_context *ldb,
-                                  struct smb_trans2 *trans,
-                                  struct loadparm_context *lp_ctx)
-{
-        /*
-         * TODO for the moment we just return the local domain
-         */
-        DATA_BLOB outblob;
-        enum ndr_err_code ndr_err;
-        NTSTATUS status;
-        const char *dns_domain = lpcfg_dnsdomain(lp_ctx);
-        const char *netbios_domain = lpcfg_workgroup(lp_ctx);
-        struct dfs_referral_resp resp;
-        struct dfs_referral_type *tab;
-        struct dfs_referral_type *referral;
-        const char *referral_str;
-        /* In the future this needs to be fetched from the ldb */
-        uint32_t found_domain = 2;
-        uint32_t current_pos = 0;
-        TALLOC_CTX *context;
-
-        if (lpcfg_server_role(lp_ctx) != ROLE_DOMAIN_CONTROLLER) {
-                DEBUG(10 ,("Received a domain referral request on a non DC\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (dfsreq->max_referral_level < 3) {
-                DEBUG(2,("invalid max_referral_level %u\n",
-                         dfsreq->max_referral_level));
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        context = talloc_new(ctx);
-        NT_STATUS_HAVE_NO_MEMORY(context);
-
-        resp.path_consumed = 0;
-        resp.header_flags = 0; /* Do like w2k3 */
-        resp.nb_referrals = found_domain; /* the fqdn one + the NT domain */
-
-        tab = talloc_array(context, struct dfs_referral_type, found_domain);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(tab, context);
-
-        referral = talloc(tab, struct dfs_referral_type);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral, context);
-        referral_str = talloc_asprintf(referral, "\\%s", netbios_domain);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral_str, context);
-        status = fill_domain_dfs_referraltype(referral,  3,
-                                              referral_str,
-                                              NULL, 0);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(2,(__location__ ":Unable to fill domain referral structure\n"));
-                talloc_free(context);
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        tab[current_pos] = *referral;
-        current_pos++;
-
-        referral = talloc(tab, struct dfs_referral_type);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral, context);
-        referral_str = talloc_asprintf(referral, "\\%s", dns_domain);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral_str, context);
-        status = fill_domain_dfs_referraltype(referral,  3,
-                                              referral_str,
-                                              NULL, 0);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(2,(__location__ ":Unable to fill domain referral structure\n"));
-                talloc_free(context);
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-        tab[current_pos] = *referral;
-        current_pos++;
-
-        /*
-         * Put here the code from filling the array for trusted domain
-         */
-        resp.referral_entries = tab;
-
-        ndr_err = ndr_push_struct_blob(&outblob, context,
-                                &resp,
-                                (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                DEBUG(2,(__location__ ":NDR marchalling of domain deferral response failed\n"));
-                talloc_free(context);
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        if (outblob.length > trans->in.max_data) {
-                bool ok = false;
-
-                DEBUG(3, ("Blob is too big for the output buffer "
-                          "size %u max %u\n",
-                          (unsigned int)outblob.length, trans->in.max_data));
-
-                if (trans->in.max_data != MAX_DFS_RESPONSE) {
-                        /* As specified in MS-DFSC.pdf 3.3.5.2 */
-                        talloc_free(context);
-                        return STATUS_BUFFER_OVERFLOW;
-                }
-
-                /*
-                 * The answer is too big, so let's remove some answers
-                 */
-                while (!ok && resp.nb_referrals > 2) {
-                        data_blob_free(&outblob);
-
-                        /*
-                         * Let's scrap the first referral (for now)
-                         */
-                        resp.nb_referrals -= 1;
-                        resp.referral_entries += 1;
-
-                        ndr_err = ndr_push_struct_blob(&outblob, context,
-                                &resp,
-                                (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
-                        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                                talloc_free(context);
-                                return NT_STATUS_INTERNAL_ERROR;
-                        }
-
-                        if (outblob.length <= MAX_DFS_RESPONSE) {
-                                DEBUG(10,("DFS: managed to reduce the size of referral initial"
-                                          "number of referral %d, actual count: %d",
-                                          found_domain, resp.nb_referrals));
-                                ok = true;
-                                break;
-                        }
-                }
-
-                if (!ok && resp.nb_referrals == 2) {
-                        DEBUG(0, (__location__ "; Not able to fit the domain and realm in DFS a "
-                                  " 56K buffer, something must be broken"));
-                        talloc_free(context);
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-        }
-
-        TRANS2_CHECK(trans2_setup_reply(trans, 0, outblob.length, 0));
-
-        trans->out.data = outblob;
-        talloc_steal(ctx, outblob.data);
-        talloc_free(context);
-        return NT_STATUS_OK;
-}
-
-/*
- * Handle the logic for dfs referral request like \\domain
- * or \\domain\sysvol or \\fqdn or \\fqdn\netlogon
- */
-static NTSTATUS dodc_or_sysvol_referral(TALLOC_CTX *ctx,
-                                        const struct dfs_GetDFSReferral_in dfsreq,
-                                        const char* requestedname,
-                                        struct ldb_context *ldb,
-                                        struct smb_trans2 *trans,
-                                        struct smbsrv_request *req,
-                                        struct loadparm_context *lp_ctx)
-{
-        /*
-         * It's not a "standard" DFS referral but a referral to get the DC list
-         * or sysvol/netlogon
-         * Let's check that it's for one of our domain ...
-         */
-        DATA_BLOB outblob;
-        NTSTATUS status;
-        unsigned int num_domain = 1;
-        enum ndr_err_code ndr_err;
-        const char *requesteddomain;
-        const char *realm = lpcfg_realm(lp_ctx);
-        const char *domain = lpcfg_workgroup(lp_ctx);
-        const char *site_name = NULL; /* Name of the site where the client is */
-        char *share = NULL;
-        bool found = false;
-        bool need_fqdn = false;
-        bool dc_referral = true;
-        unsigned int i;
-        char *tmp;
-        struct dc_set **set;
-        char const **domain_list;
-        struct tsocket_address *remote_address;
-        char *client_addr = NULL;
-        TALLOC_CTX *context;
-
-        if (lpcfg_server_role(lp_ctx) != ROLE_DOMAIN_CONTROLLER) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (dfsreq.max_referral_level < 3) {
-                DEBUG(2,("invalid max_referral_level %u\n",
-                         dfsreq.max_referral_level));
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        context = talloc_new(ctx);
-        NT_STATUS_HAVE_NO_MEMORY(context);
-
-        if (requestedname[0] == '\\' && !strchr(requestedname+1,'\\')) {
-                requestedname++;
-        }
-        requesteddomain = requestedname;
-
-        if (strchr(requestedname,'\\')) {
-                char *subpart;
-                /* we have a second part */
-                requesteddomain = talloc_strdup(context, requestedname+1);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(requesteddomain, context);
-                subpart = strchr(requesteddomain,'\\');
-                subpart[0] = '\0';
-        }
-        tmp = strchr(requestedname + 1,'\\'); /* To get second \ if any */
-
-        if (tmp != NULL) {
-                /* There was a share */
-                share = tmp+1;
-                dc_referral = false;
-        }
-
-        /*
-         * We will fetch the trusted domain list soon with something like this:
-         *
-         * "(&(|(flatname=%s)(cn=%s)(trustPartner=%s)(flatname=%s)(cn=%s)
-         * (trustPartner=%s))(objectclass=trustedDomain))"
-         *
-         * Allocate for num_domain + 1 so that the last element will be NULL)
-         */
-        domain_list = talloc_array(context, const char*, num_domain+1);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(domain_list, context);
-
-        domain_list[0] = realm;
-        domain_list[1] = domain;
-        for (i=0; i<=num_domain; i++) {
-                if (strncasecmp(domain_list[i], requesteddomain, strlen(domain_list[i])) == 0) {
-                        found = true;
-                        break;
-                }
-        }
-
-        if (!found) {
-                /* The requested domain is not one that we support */
-                DEBUG(3,("Requested referral for domain %s, but we don't handle it",
-                         requesteddomain));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (strchr(requestedname,'.')) {
-                need_fqdn = 1;
-        }
-
-        remote_address = req->smb_conn->connection->remote_address;
-        if (tsocket_address_is_inet(remote_address, "ip")) {
-                client_addr = tsocket_address_inet_addr_string(remote_address, context);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(client_addr, context);
-        }
-
-        status = get_dcs(context, ldb, site_name, need_fqdn, &set, 0);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(3,("Unable to get list of DCs\n"));
-                talloc_free(context);
-                return status;
-        }
-
-        if (dc_referral) {
-                const char **dc_list = NULL;
-                uint32_t num_dcs = 0;
-                struct dfs_referral_type *referral;
-                const char *referral_str;
-                struct dfs_referral_resp resp;
-
-                for(i=0; set[i]; i++) {
-                        uint32_t j;
-
-                        dc_list = talloc_realloc(context, dc_list, const char*,
-                                                 num_dcs + set[i]->count + 1);
-                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(dc_list, context);
-
-                        for(j=0; j<set[i]->count; j++) {
-                                dc_list[num_dcs + j] = talloc_move(context, &set[i]->names[j]);
-                        }
-                        num_dcs = num_dcs + set[i]->count;
-                        TALLOC_FREE(set[i]);
-                        dc_list[num_dcs] = NULL;
-                }
-
-                resp.path_consumed = 0;
-                resp.header_flags = 0; /* Do like w2k3 and like in 3.3.5.3 of MS-DFSC*/
-
-                /*
-                 * The NumberOfReferrals field MUST be set to 1,
-                 * independent of the number of DC names
-                 * returned. (as stated in 3.3.5.3 of MS-DFSC)
-                 */
-                resp.nb_referrals = 1;
-
-                /* Put here the code from filling the array for trusted domain */
-                referral = talloc(context, struct dfs_referral_type);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral, context);
-
-                referral_str = talloc_asprintf(referral, "\\%s",
-                                               requestedname);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral_str, context);
-
-                status = fill_domain_dfs_referraltype(referral,  3,
-                                                referral_str,
-                                                dc_list, num_dcs);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(2,(__location__ ":Unable to fill domain referral structure\n"));
-                        talloc_free(context);
-                        return NT_STATUS_UNSUCCESSFUL;
-                }
-                resp.referral_entries = referral;
-
-                ndr_err = ndr_push_struct_blob(&outblob, context,
-                                &resp,
-                                (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        DEBUG(2,(__location__ ":NDR marshalling of dfs referral response failed\n"));
-                        talloc_free(context);
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-        } else {
-                unsigned int nb_entries = 0;
-                unsigned int current = 0;
-                struct dfs_referral_type *tab;
-                struct dfs_referral_resp resp;
-
-                for(i=0; set[i]; i++) {
-                        nb_entries = nb_entries + set[i]->count;
-                }
-
-                resp.path_consumed = 2*strlen(requestedname); /* The length is expected in bytes */
-                resp.header_flags = DFS_HEADER_FLAG_STORAGE_SVR; /* Do like w2k3 and like in 3.3.5.3 of MS-DFSC*/
-
-                /*
-                 * The NumberOfReferrals field MUST be set to 1,
-                 * independent of the number of DC names
-                 * returned. (as stated in 3.3.5.3 of MS-DFSC)
-                 */
-                resp.nb_referrals = nb_entries;
-
-                tab = talloc_array(context, struct dfs_referral_type, nb_entries);
-                NT_STATUS_HAVE_NO_MEMORY(tab);
-
-                for(i=0; set[i]; i++) {
-                        uint32_t j;
-
-                        for(j=0; j< set[i]->count; j++) {
-                                struct dfs_referral_type *referral;
-                                const char *referral_str;
-
-                                referral = talloc(tab, struct dfs_referral_type);
-                                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral, context);
-
-                                referral_str = talloc_asprintf(referral, "\\%s\\%s",
-                                                               set[i]->names[j], share);
-                                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral_str, context);
-
-                                status = fill_normal_dfs_referraltype(referral,
-                                                dfsreq.max_referral_level,
-                                                requestedname, referral_str, j==0);
-                                if (!NT_STATUS_IS_OK(status)) {
-                                        DEBUG(2, (__location__ ": Unable to fill a normal dfs referral object"));
-                                        talloc_free(context);
-                                        return NT_STATUS_UNSUCCESSFUL;
-                                }
-                                tab[current] = *referral;
-                                current++;
-                        }
-                }
-                resp.referral_entries = tab;
-
-                ndr_err = ndr_push_struct_blob(&outblob, context,
-                                        &resp,
-                                        (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        DEBUG(2,(__location__ ":NDR marchalling of domain deferral response failed\n"));
-                        talloc_free(context);
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-        }
-
-        TRANS2_CHECK(trans2_setup_reply(trans, 0, outblob.length, 0));
-
-        /*
-         * TODO If the size is too big we should remove
-         * some DC from the answer or return STATUS_BUFFER_OVERFLOW
-         */
-        trans->out.data = outblob;
-        talloc_steal(ctx, outblob.data);
-        talloc_free(context);
-        return NT_STATUS_OK;
-}
-
 /*
   trans2 getdfsreferral implementation
@@ -1612 +862 @@
         enum ndr_err_code ndr_err;
         struct smb_trans2 *trans = op->trans;
-        struct dfs_GetDFSReferral_in dfsreq;
-        TALLOC_CTX *context;
         struct ldb_context *ldb;
         struct loadparm_context *lp_ctx;
-        const char *realm, *nbname, *requestedname;
-        char *fqdn, *tmp;
         NTSTATUS status;
+        struct dfs_GetDFSReferral *r;
+        DATA_BLOB outblob = data_blob_null;
+        uint16_t nb_referrals = 0;
 
         lp_ctx = req->tcon->ntvfs->lp_ctx;
@@ -1625 +874 @@
         }
 
-        context = talloc_new(req);
-        NT_STATUS_HAVE_NO_MEMORY(context);
-
-        ldb = samdb_connect(context, req->tcon->ntvfs->event_ctx, lp_ctx, system_session(lp_ctx), 0);
+        r = talloc_zero(req, struct dfs_GetDFSReferral);
+        NT_STATUS_HAVE_NO_MEMORY(r);
+
+        ldb = samdb_connect(r, req->tcon->ntvfs->event_ctx, lp_ctx, system_session(lp_ctx), 0);
         if (ldb == NULL) {
                 DEBUG(2,(__location__ ": Failed to open samdb\n"));
-                talloc_free(context);
+                talloc_free(r);
                 return NT_STATUS_INTERNAL_ERROR;
         }
 
-        ndr_err = ndr_pull_struct_blob(&trans->in.params, op,
-                                       &dfsreq,
+        ndr_err = ndr_pull_struct_blob(&trans->in.params, r,
+                                       &r->in.req,
                                        (ndr_pull_flags_fn_t)ndr_pull_dfs_GetDFSReferral_in);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -1642 +891 @@
                 DEBUG(2,(__location__ ": Failed to parse GetDFSReferral_in - %s\n",
                          nt_errstr(status)));
-                talloc_free(context);
+                talloc_free(r);
                 return status;
         }
 
-        DEBUG(10, ("Requested DFS name: %s length: %u\n",
-                   dfsreq.servername, (unsigned int)strlen(dfsreq.servername)));
-
-        /*
-         * If the servername is "" then we are in a case of domain dfs
-         * and the client just searches for the list of local domain
-         * it is attached and also trusted ones.
-         */
-        requestedname = dfsreq.servername;
-        if (requestedname == NULL || requestedname[0] == '\0') {
-                return dodomain_referral(op, &dfsreq, ldb, trans, lp_ctx);
-        }
-
-        realm = lpcfg_realm(lp_ctx);
-        nbname = lpcfg_netbios_name(lp_ctx);
-        fqdn = talloc_asprintf(context, "%s.%s", nbname, realm);
-
-        if ((strncasecmp(requestedname+1, nbname, strlen(nbname)) == 0) ||
-            (strncasecmp(requestedname+1, fqdn, strlen(fqdn)) == 0) ) {
+        DEBUG(8, ("Requested DFS name: %s length: %u\n",
+                   r->in.req.servername,
+                   (unsigned int)strlen_m(r->in.req.servername)*2));
+
+        status = dfs_server_ad_get_referrals(lp_ctx, ldb,
+                                req->smb_conn->connection->remote_address, r);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(r);
+                return status;
+        }
+
+        ndr_err = ndr_push_struct_blob(&outblob, trans,
+                                r->out.resp,
+                                (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                DEBUG(2,(__location__ ":NDR marchalling of domain deferral response failed\n"));
+                talloc_free(r);
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        nb_referrals = r->out.resp->nb_referrals;
+
+        if (outblob.length > trans->in.max_data) {
+                bool ok = false;
+
+                DEBUG(3, ("Blob is too big for the output buffer "
+                          "size %u max %u\n",
+                          (unsigned int)outblob.length, trans->in.max_data));
+
+                if (trans->in.max_data != MAX_DFS_RESPONSE) {
+                        /* As specified in MS-DFSC.pdf 3.3.5.2 */
+                        talloc_free(r);
+                        return STATUS_BUFFER_OVERFLOW;
+                }
+
                 /*
-                 * the referral request starts with \NETBIOSNAME or \fqdn
-                 * it's a standalone referral we do not do it
-                 * (TODO correct this)
-                 * If a DFS link that is a complete prefix of the DFS referral
-                 * request path is identified, the server MUST return a DFS link
-                 * referral response; otherwise, if it has a match for the DFS root,
-                 * it MUST return a root referral response.
+                 * The answer is too big, so let's remove some answers
                  */
-                DEBUG(3, ("Received a standalone request for %s, we do not support standalone referral yet",requestedname));
-                talloc_free(context);
-                return NT_STATUS_NOT_FOUND;
-        }
-        talloc_free(fqdn);
-
-        tmp = strchr(requestedname + 1,'\\'); /* To get second \ if any */
-
-        /*
-         * If we have no slash at the first position or (foo.bar.domain.net)
-         * a slash at the first position but no other slash (\foo.bar.domain.net)
-         * or a slash at the first position and another slash
-         * and netlogon or sysvol after the second slash
-         * (\foo.bar.domain.net\sysvol) then we will handle it because
-         * it's either a dc referral or a sysvol/netlogon referral
-         */
-        if (requestedname[0] != '\\' ||
-            tmp == NULL ||
-            strcasecmp(tmp+1, "sysvol") == 0 ||
-            strcasecmp(tmp+1, "netlogon") == 0) {
-                status = dodc_or_sysvol_referral(op, dfsreq, requestedname,
-                                               ldb, trans, req, lp_ctx);
-                talloc_free(context);
-                return status;
-        }
-
-        if (requestedname[0] == '\\' &&
-            tmp &&
-            strchr(tmp+1, '\\') &&
-            (strncasecmp(tmp+1, "sysvol", 6) == 0 ||
-             strncasecmp(tmp+1, "netlogon", 8) == 0)) {
-                /*
-                 * We have more than two \ so it something like
-                 * \domain\sysvol\foobar
-                 */
-                talloc_free(context);
-                return NT_STATUS_NOT_FOUND;
-        }
-
-        talloc_free(context);
-        /* By default until all the case are handled*/
-        return NT_STATUS_NOT_FOUND;
+                while (!ok && r->out.resp->nb_referrals > 2) {
+                        data_blob_free(&outblob);
+
+                        /*
+                         * Let's scrap the last referral (for now)
+                         */
+                        r->out.resp->nb_referrals -= 1;
+
+                        ndr_err = ndr_push_struct_blob(&outblob, trans,
+                                r->out.resp,
+                                (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
+                        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                                talloc_free(r);
+                                return NT_STATUS_INTERNAL_ERROR;
+                        }
+
+                        if (outblob.length <= MAX_DFS_RESPONSE) {
+                                DEBUG(10,("DFS: managed to reduce the size of referral initial"
+                                          "number of referral %d, actual count: %d",
+                                          nb_referrals, r->out.resp->nb_referrals));
+                                ok = true;
+                                break;
+                        }
+                }
+
+                if (!ok && r->out.resp->nb_referrals <= 2) {
+                        DEBUG(8, (__location__ "; Not able to fit the domain and realm in DFS a "
+                                  " 56K buffer, something must be broken"));
+                        talloc_free(r);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+        }
+
+        TRANS2_CHECK(trans2_setup_reply(trans, 0, outblob.length, 0));
+
+        trans->out.data = outblob;
+        talloc_free(r);
+        return NT_STATUS_OK;
 }
 

vendor/current/source4/smb_server/smb/wscript_build

@@ -4 +4 @@
         source='receive.c negprot.c nttrans.c reply.c request.c search.c service.c sesssetup.c srvtime.c trans2.c signing.c',
         autoproto='smb_proto.h',
-        public_deps='ntvfs LIBPACKET credentials samba_server_gensec'
+        deps='dfs_server_ad',
+        public_deps='ntvfs LIBPACKET samba-credentials samba_server_gensec',
+        enabled=bld.CONFIG_SET('WITH_NTVFS_FILESERVER')
         )
 

vendor/current/source4/smb_server/smb2/fileinfo.c

@@ -251 +251 @@
         SMB2SRV_CHECK_ASYNC_STATUS(op, struct smb2srv_setinfo_op);
 
-        SMB2SRV_CHECK(smb2srv_setup_reply(req, 0x02, false, 0));
+        SMB2SRV_CHECK(smb2srv_setup_reply(op->req, 0x02, false, 0));
 
         smb2srv_send_reply(req);

vendor/current/source4/smb_server/smb2/keepalive.c

@@ -52 +52 @@
 void smb2srv_keepalive_recv(struct smb2srv_request *req)
 {
-        uint16_t _pad;
-
         if (req->in.body_size != 0x04) {
                 smb2srv_send_error(req,  NT_STATUS_INVALID_PARAMETER);
@@ -64 +62 @@
         }
 
-        _pad    = SVAL(req->in.body, 0x02);
-
         req->status = smb2srv_keepalive_backend(req);
 

vendor/current/source4/smb_server/smb2/negprot.c

@@ -50 +50 @@
         if (!NT_STATUS_IS_OK(nt_status)) {
                 DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status)));
-                talloc_free(server_credentials);
-                server_credentials = NULL;
+                /*
+                 * We keep the server_credentials as anonymous
+                 * this is required for the spoolss.notify test
+                 */
         }
 
@@ -80 +82 @@
         }
 
-        nt_status = gensec_update(gensec_security, req, null_data_blob, &blob);
+        nt_status = gensec_update_ev(gensec_security, req, req->smb_conn->connection->event.ctx, null_data_blob, &blob);
         if (!NT_STATUS_IS_OK(nt_status) && !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
                 DEBUG(0, ("Failed to get SPNEGO to give us the first token: %s\n", nt_errstr(nt_status)));
@@ -98 +100 @@
         uint16_t i;
         uint16_t dialect = 0;
+        enum smb_signing_setting signing_setting;
+        struct loadparm_context *lp_ctx = req->smb_conn->lp_ctx;
 
         /* we only do one dialect for now */
@@ -114 +118 @@
         }
 
-        req->smb_conn->negotiate.protocol = PROTOCOL_SMB2;
+        req->smb_conn->negotiate.protocol = PROTOCOL_SMB2_02;
 
         current_time = timeval_current(); /* TODO: handle timezone?! */
@@ -120 +124 @@
 
         ZERO_STRUCT(io->out);
-        switch (lpcfg_server_signing(req->smb_conn->lp_ctx)) {
+
+        signing_setting = lpcfg_server_signing(lp_ctx);
+        if (signing_setting == SMB_SIGNING_DEFAULT) {
+                /*
+                 * If we are a domain controller, SMB signing is
+                 * really important, as it can prevent a number of
+                 * attacks on communications between us and the
+                 * clients
+                 *
+                 * However, it really sucks (no sendfile, CPU
+                 * overhead) performance-wise when used on a
+                 * file server, so disable it by default
+                 * on non-DCs
+                 */
+
+                if (lpcfg_server_role(lp_ctx) >= ROLE_ACTIVE_DIRECTORY_DC) {
+                        signing_setting = SMB_SIGNING_REQUIRED;
+                } else {
+                        signing_setting = SMB_SIGNING_OFF;
+                }
+        }
+
+        switch (signing_setting) {
+        case SMB_SIGNING_DEFAULT:
+        case SMB_SIGNING_IPC_DEFAULT:
+                smb_panic(__location__);
+                break;
         case SMB_SIGNING_OFF:
                 io->out.security_mode = 0;
                 break;
-        case SMB_SIGNING_SUPPORTED:
-        case SMB_SIGNING_AUTO:
+        case SMB_SIGNING_DESIRED:
+        case SMB_SIGNING_IF_REQUIRED:
                 io->out.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
                 break;

vendor/current/source4/smb_server/smb2/receive.c

@@ -70 +70 @@
         req->smb_conn = smb_conn;
 
+        req->chained_session_id = UINT64_MAX;
+        req->chained_tree_id = UINT32_MAX;
+
         talloc_set_destructor(req, smb2srv_request_destructor);
 
@@ -78 +81 @@
                              bool body_dynamic_present, uint32_t body_dynamic_size)
 {
-        uint32_t flags = SMB2_HDR_FLAG_REDIRECT;
+        uint32_t flags = IVAL(req->in.hdr, SMB2_HDR_FLAGS);
         uint32_t pid = IVAL(req->in.hdr, SMB2_HDR_PID);
         uint32_t tid = IVAL(req->in.hdr, SMB2_HDR_TID);
+        uint16_t credits = SVAL(req->in.hdr, SMB2_HDR_CREDIT);
+
+        if (credits == 0) {
+                credits = 1;
+        }
+
+        flags |= SMB2_HDR_FLAG_REDIRECT;
 
         if (req->pending_id) {
@@ -86 +96 @@
                 pid = req->pending_id;
                 tid = 0;
+                credits = 0;
         }
 
@@ -111 +122 @@
         SIVAL(req->out.hdr, 0,                          SMB2_MAGIC);
         SSVAL(req->out.hdr, SMB2_HDR_LENGTH,            SMB2_HDR_BODY);
-        SSVAL(req->out.hdr, SMB2_HDR_EPOCH,             0);
+        SSVAL(req->out.hdr, SMB2_HDR_CREDIT_CHARGE,
+              SVAL(req->in.hdr, SMB2_HDR_CREDIT_CHARGE));
         SIVAL(req->out.hdr, SMB2_HDR_STATUS,            NT_STATUS_V(req->status));
         SSVAL(req->out.hdr, SMB2_HDR_OPCODE,            SVAL(req->in.hdr, SMB2_HDR_OPCODE));
-        SSVAL(req->out.hdr, SMB2_HDR_CREDIT,            0x0001);
+        SSVAL(req->out.hdr, SMB2_HDR_CREDIT,            credits);
         SIVAL(req->out.hdr, SMB2_HDR_FLAGS,             flags);
         SIVAL(req->out.hdr, SMB2_HDR_NEXT_COMMAND,      0);
@@ -121 +133 @@
         SIVAL(req->out.hdr, SMB2_HDR_TID,               tid);
         SBVAL(req->out.hdr, SMB2_HDR_SESSION_ID,        BVAL(req->in.hdr, SMB2_HDR_SESSION_ID));
-        memset(req->out.hdr+SMB2_HDR_SIGNATURE, 0, 16);
+        memcpy(req->out.hdr+SMB2_HDR_SIGNATURE,
+               req->in.hdr+SMB2_HDR_SIGNATURE, 16);
 
         /* set the length of the fixed body part and +1 if there's a dynamic part also */
@@ -143 +156 @@
 {
         NTSTATUS status;
+        struct smbsrv_connection *smb_conn = p_req->smb_conn;
         struct smb2srv_request *req;
         uint32_t chain_offset;
@@ -159 +173 @@
                 DEBUG(2,("Invalid SMB2 chained packet at offset 0x%X from last hdr 0x%X\n",
                         chain_offset, last_hdr_offset));
-                smbsrv_terminate_connection(p_req->smb_conn, "Invalid SMB2 chained packet");
+                smbsrv_terminate_connection(smb_conn, "Invalid SMB2 chained packet");
                 return;
         }
@@ -167 +181 @@
                 DEBUG(2,("Invalid SMB chained packet: protocol prefix: 0x%08X\n",
                          protocol_version));
-                smbsrv_terminate_connection(p_req->smb_conn, "NON-SMB2 chained packet");
-                return;
-        }
-
-        req = smb2srv_init_request(p_req->smb_conn);
+                smbsrv_terminate_connection(smb_conn, "NON-SMB2 chained packet");
+                return;
+        }
+
+        req = smb2srv_init_request(smb_conn);
         if (!req) {
-                smbsrv_terminate_connection(p_req->smb_conn, "SMB2 chained packet - no memory");
-                return;
-        }
+                smbsrv_terminate_connection(smb_conn, "SMB2 chained packet - no memory");
+                return;
+        }
+
+        talloc_steal(req, p_req);
 
         req->in.buffer          = talloc_steal(req, p_req->in.buffer);
@@ -194 +210 @@
                 uint16_t opcode = SVAL(req->in.hdr, SMB2_HDR_OPCODE);
                 if (opcode == SMB2_OP_NEGPROT) {
-                        smbsrv_terminate_connection(req->smb_conn, "Bad body size in SMB2 negprot");                    
+                        smbsrv_terminate_connection(smb_conn, "Bad body size in SMB2 negprot");
+                        return;
                 } else {
                         smb2srv_send_error(req, NT_STATUS_INVALID_PARAMETER);
+                        return;
                 }
         }
@@ -224 +242 @@
                         req->chained_file_handle = req->_chained_file_handle;
                 }
+                req->chained_session_id = p_req->chained_session_id;
+                req->chained_tree_id = p_req->chained_tree_id;
                 req->chain_status = p_req->chain_status;
         }
@@ -234 +254 @@
         status = smb2srv_reply(req);
         if (!NT_STATUS_IS_OK(status)) {
-                smbsrv_terminate_connection(req->smb_conn, nt_errstr(status));
-                talloc_free(req);
+                smbsrv_terminate_connection(smb_conn, nt_errstr(status));
                 return;
         }
@@ -252 +271 @@
 
         if (req->out.size > NBT_HDR_SIZE) {
-                _smb2_setlen(req->out.buffer, req->out.size - NBT_HDR_SIZE);
+                _smb_setlen_tcp(req->out.buffer, req->out.size - NBT_HDR_SIZE);
         }
 
@@ -270 +289 @@
         if (!NT_STATUS_IS_OK(status)) {
                 smbsrv_terminate_connection(req->smb_conn, nt_errstr(status));
+                return;
         }
         if (req->chain_offset) {
@@ -333 +353 @@
         }
 
+        if (flags & SMB2_HDR_FLAG_CHAINED) {
+                uid = req->chained_session_id;
+                tid = req->chained_tree_id;
+        }
+
         req->session    = smbsrv_session_find(req->smb_conn, uid, req->request_time);
         req->tcon       = smbsrv_smb2_tcon_find(req->session, tid, req->request_time);
+
+        req->chained_session_id = uid;
+        req->chained_tree_id = tid;
 
         errno = 0;
@@ -425 +453 @@
                 smb2srv_keepalive_recv(req);
                 return NT_STATUS_OK;
-        case SMB2_OP_FIND:
+        case SMB2_OP_QUERY_DIRECTORY:
                 if (!req->session) goto nosession;
                 if (!req->tcon) goto notcon;
@@ -570 +598 @@
         bool signing_used = false;
         int id;
+        uint16_t credits = SVAL(req->in.hdr, SMB2_HDR_CREDIT);
+
+        if (credits == 0) {
+                credits = 1;
+        }
 
         if (req->pending_id) {
                 return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        if (req->smb_conn->connection->event.fde == NULL) {
+                /* the socket has been destroyed - no point trying to send an error! */
+                return NT_STATUS_REMOTE_DISCONNECT;
         }
 
@@ -581 +619 @@
         }
 
-        DLIST_ADD_END(req->smb_conn->requests2.list, req, struct smb2srv_request *);
+        DLIST_ADD_END(req->smb_conn->requests2.list, req);
         req->pending_id = id;
-
-        if (req->smb_conn->connection->event.fde == NULL) {
-                /* the socket has been destroyed - no point trying to send an error! */
-                return NT_STATUS_REMOTE_DISCONNECT;
-        }
 
         talloc_set_destructor(req, smb2srv_request_deny_destructor);
@@ -597 +630 @@
 
         SIVAL(req->out.hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
+        SSVAL(req->out.hdr, SMB2_HDR_CREDIT, credits);
 
         SSVAL(req->out.body, 0x02, 0);
@@ -664 +698 @@
         smb_conn->negotiate.zone_offset = get_time_zone(time(NULL));
 
-        smb_conn->config.security = SEC_USER;
         smb_conn->config.nt_status_support = true;
 

vendor/current/source4/smb_server/smb2/sesssetup.c

@@ -32 +32 @@
 static void smb2srv_sesssetup_send(struct smb2srv_request *req, union smb_sesssetup *io)
 {
-        uint16_t credit;
-
         if (NT_STATUS_IS_OK(req->status)) {
-                credit = 0x0003;
+                /* nothing */
         } else if (NT_STATUS_EQUAL(req->status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-                credit = 0x0002;
+                /* nothing */
         } else {
                 smb2srv_send_error(req, req->status);
@@ -45 +43 @@
         SMB2SRV_CHECK(smb2srv_setup_reply(req, 0x08, true, io->smb2.out.secblob.length));
 
-        SSVAL(req->out.hdr, SMB2_HDR_CREDIT,    credit);
         SBVAL(req->out.hdr, SMB2_HDR_SESSION_ID,        io->smb2.out.uid);
 
@@ -68 +65 @@
         struct smbsrv_session *smb_sess = ctx->smb_sess;
         struct auth_session_info *session_info = NULL;
+        enum security_user_level user_level;
         NTSTATUS status;
 
@@ -80 +78 @@
         }
 
-        status = gensec_session_info(smb_sess->gensec_ctx, &session_info);
+        status = gensec_session_info(smb_sess->gensec_ctx, smb_sess, &session_info);
         if (!NT_STATUS_IS_OK(status)) {
                 goto failed;
@@ -93 +91 @@
         req->session = smb_sess;
 
-        if (smb_sess->smb2_signing.required) {
-                /* activate smb2 signing on the session */
-                smb_sess->smb2_signing.active = true;
-        }
+        user_level = security_session_user_level(smb_sess->session_info, NULL);
+        if (user_level >= SECURITY_USER) {
+                if (smb_sess->smb2_signing.required) {
+                        /* activate smb2 signing on the session */
+                        smb_sess->smb2_signing.active = true;
+                }
+                /* we need to sign the session setup response */
+                req->is_signed = true;
+        }
+
 done:
         io->smb2.out.uid = smb_sess->vuid;
@@ -164 +168 @@
 
         if (!smb_sess) {
+                status = NT_STATUS_USER_SESSION_DELETED;
+                goto failed;
+        }
+
+        if (smb_sess->session_info) {
                 /* see WSPP test suite - test 11 */
                 status = NT_STATUS_REQUEST_NOT_ACCEPTED;
@@ -193 +202 @@
         if (io->smb2.in.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) {
                 smb_sess->smb2_signing.required = true;
-        } else if (req->smb_conn->smb2_signing_required) {
-                /*
-                 * if required signing was negotiates in SMB2 Negotiate
-                 * then the client made an error not using it here
-                 */
-                DEBUG(1, ("SMB2 signing required on the connection but not used on session\n"));
-                req->status = NT_STATUS_FOOBAR;
-                goto failed;
         }
 
@@ -274 +275 @@
 void smb2srv_logoff_recv(struct smb2srv_request *req)
 {
-        uint16_t _pad;
-
         SMB2SRV_CHECK_BODY_SIZE(req, 0x04, false);
-
-        _pad    = SVAL(req->in.body, 0x02);
 
         req->status = smb2srv_logoff_backend(req);

vendor/current/source4/smb_server/smb2/smb2_server.h

@@ -65 +65 @@
         uint8_t _chained_file_handle[16];
         uint8_t *chained_file_handle;
+        uint64_t chained_session_id;
+        uint32_t chained_tree_id;
 
         bool is_signed;

vendor/current/source4/smb_server/smb2/tcon.c

@@ -242 +242 @@
         const char *service = io->smb2.in.path;
         struct share_config *scfg;
-        const char *sharetype;
+        char *sharetype;
         uint64_t ntvfs_caps = 0;
 
@@ -266 +266 @@
 
         /* work out what sort of connection this is */
-        sharetype = share_string_option(scfg, SHARE_TYPE, "DISK");
+        sharetype = share_string_option(req, scfg, SHARE_TYPE, "DISK");
         if (sharetype && strcmp(sharetype, "IPC") == 0) {
                 type = NTVFS_IPC;
@@ -274 +274 @@
                 type = NTVFS_DISK;
         }
+        TALLOC_FREE(sharetype);
 
         tcon = smbsrv_smb2_tcon_new(req->session, scfg->name);
@@ -360 +361 @@
 static void smb2srv_tcon_send(struct smb2srv_request *req, union smb_tcon *io)
 {
-        uint16_t credit;
-
         if (!NT_STATUS_IS_OK(req->status)) {
                 smb2srv_send_error(req, req->status);
                 return;
         }
-        if (io->smb2.out.share_type == NTVFS_IPC) {
-                /* if it's an IPC share vista returns 0x0005 */
-                credit = 0x0005;
-        } else {
-                credit = 0x0001;
-        }
 
         SMB2SRV_CHECK(smb2srv_setup_reply(req, 0x10, false, 0));
 
         SIVAL(req->out.hdr,     SMB2_HDR_TID,   io->smb2.out.tid);
-        SSVAL(req->out.hdr,     SMB2_HDR_CREDIT,credit);
 
         SCVAL(req->out.body,    0x02,           io->smb2.out.share_type);
@@ -443 +435 @@
 void smb2srv_tdis_recv(struct smb2srv_request *req)
 {
-        uint16_t _pad;
-
         SMB2SRV_CHECK_BODY_SIZE(req, 0x04, false);
-
-        _pad    = SVAL(req->in.body, 0x02);
 
         req->status = smb2srv_tdis_backend(req);

vendor/current/source4/smb_server/smb2/wscript_build

@@ -4 +4 @@
         source='receive.c negprot.c sesssetup.c tcon.c fileio.c fileinfo.c find.c keepalive.c',
         autoproto='smb2_proto.h',
-        public_deps='ntvfs LIBPACKET LIBCLI_SMB2 samba_server_gensec NDR_DFSBLOBS'
+        public_deps='ntvfs LIBPACKET LIBCLI_SMB2 samba_server_gensec NDR_DFSBLOBS',
+        enabled=bld.CONFIG_SET('WITH_NTVFS_FILESERVER')
         )
 

vendor/current/source4/smb_server/smb_server.c

@@ -64 +64 @@
                 return smbsrv_recv_smb_request(smb_conn, blob);
         case SMB2_MAGIC:
-                if (lpcfg_srv_maxprotocol(smb_conn->lp_ctx) < PROTOCOL_SMB2) break;
+                if (lpcfg_server_max_protocol(smb_conn->lp_ctx) < PROTOCOL_SMB2_02) break;
                 status = smbsrv_init_smb2_connection(smb_conn);
                 NT_STATUS_NOT_OK_RETURN(status);
@@ -191 +191 @@
                 status = stream_setup_socket(mem_ctx, event_context, lp_ctx,
                                              model_ops, &smb_stream_ops, 
-                                             "ipv4", address, &port, 
+                                             "ip", address, &port,
                                              lpcfg_socket_options(lp_ctx),
                                              NULL);

vendor/current/source4/smb_server/smb_server.h

@@ -23 +23 @@
 #include "libcli/raw/interfaces.h"
 #include "lib/socket/socket.h"
+#include "libds/common/roles.h"
 #include "../lib/util/dlinklist.h"
 #include "../librpc/gen_ndr/nbt.h"
@@ -265 +266 @@
         struct smb_request_buffer out;
 };
-
-enum security_types {SEC_SHARE,SEC_USER};
 
 /* smb server context structure. This should contain all the state
@@ -301 +300 @@
 
                 /* authentication context for multi-part negprot */
-                struct auth_context *auth_context;
+                struct auth4_context *auth_context;
         
                 /* reference to the kerberos keytab, or machine trust account */
@@ -372 +371 @@
         /* configuration parameters */
         struct {
-                enum security_types security;
                 bool nt_status_support;
         } config;
@@ -478 +476 @@
         req->ntvfs->async_states->status = cmd; \
         if (req->ntvfs->async_states->state & NTVFS_ASYNC_STATE_ASYNC) { \
-                DLIST_ADD_END(req->smb_conn->requests, req, struct smbsrv_request *); \
+                DLIST_ADD_END(req->smb_conn->requests, req); \
         } else { \
                 req->ntvfs->async_states->send_fn(req->ntvfs); \

vendor/current/source4/smb_server/wscript_build

@@ -8 +8 @@
         deps='SMB_SERVER netif shares samba-hostconfig',
         internal_module=False,
+        enabled=bld.CONFIG_SET('WITH_NTVFS_FILESERVER')
         )
-
-
-bld.SAMBA_MODULE('service_samba3_smb',
-        source='smb_samba3.c',
-        subsystem='service',
-        init_function='server_service_samba3_smb_init',
-        deps='talloc',
-        internal_module=False,
-        )
-
 
 bld.SAMBA_SUBSYSTEM('SMB_SERVER',
         source='handle.c tcon.c session.c blob.c management.c smb_server.c',
         autoproto='smb_server_proto.h',
-        public_deps='share LIBPACKET SMB_PROTOCOL SMB2_PROTOCOL'
+        public_deps='share LIBPACKET SMB_PROTOCOL SMB2_PROTOCOL',
+        enabled=bld.CONFIG_SET('WITH_NTVFS_FILESERVER')
         )